CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

WFX Phantom

malware · malware:wfx-phantom

CI secret stealer pushed into GitHub repositories from 2026-11-10 with stolen tokens; it harvests Actions secrets, runner memory and cloud tokens and plants persistence that outlasts secret rotation.

Aliases: wfx-loot

Coverage
1
first 2026-11-13 → last 2026-11-13
Latest activity
2026-11-13
WFX Phantom: stolen GitHub tokens push a CI stealer; cloud persistence meant to survive rotation; check for…
Peak priority
notable
1 notable
Targets
technology
sectors: technology, public-sector
Sources cited
4
4 hosts

Action items (1)

Do-now tasks recorded on the entries about WFX Phantom, newest first. Check the date before acting on an older one.

  • In every GitHub organisation you or your suppliers administer, search for pull requests titled "docs: dependency audit notes" and for commits titled "ci: refresh build cache", "ci: restore", "ci: cleanup", "chore: add ci helper" or "chore: add dependency audit workflow"; for each account that pushed one, revoke its tokens, rotate every secret its workflows could read and remove the AWS trust-policy changes, access keys and Azure federated credentials the stealer created, because the persistence is designed to outlast rotation.
    2026-11-13WFX Phantom: stolen GitHub tokens push a CI…

Defender insights

What each entry about WFX Phantom tells a defender to do, newest first.

2026-11-13NOTABLEWFX Phantom: stolen GitHub tokens push a CI stealer; cloud persistence meant to survive rotation; check for probe PRs

Exposure · triage · detection

Story timeline

  1. 2026-11-13WFX Phantom: stolen GitHub tokens push a CI secret stealer into repositories from 2026-11-10, steal Actions secrets, runner memory and cloud tokens, plant AWS and Azure persistence designed to outlast rotation and delete the workflow runs; StepSecurity counts more than 63,000 probe pull requests
    active-threatsWFX Phantom: stolen GitHub tokens push a CI stealer; cloud persistence meant to survive rotation; check for probe PRs

Hunting pivots

Affected products
GitHub Actions
Tags
cloudsupply-chain
ATT&CK techniques (9 across 8 tactics)

9 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.1 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessValid Accounts: Cloud Accounts · Supply Chain Compromise: Compromise Software Supply Chain
  • ExecutionCommand and Scripting Interpreter: Unix Shell
  • PersistenceValid Accounts: Cloud Accounts · Account Manipulation: Additional Cloud Credentials
  • Privilege EscalationValid Accounts: Cloud Accounts · Account Manipulation: Additional Cloud Credentials
  • StealthIndicator Removal · Valid Accounts: Cloud Accounts
  • Credential AccessUnsecured Credentials: Credentials In Files · Unsecured Credentials: Cloud Instance Metadata API
  • Lateral MovementUse Alternate Authentication Material: Application Access Token
  • CollectionData from Information Repositories: Code Repositories

Initial Access TA0001

T1078.004Valid Accounts: Cloud Accounts×1

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-11-13/wfx-phantom-github-actions-ci-secret-stealer-stolen-tokens · ATT&CK page ↗

T1195.002Supply Chain Compromise: Compromise Software Supply Chain×1

Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version.

Evidence: 2026-11-13/wfx-phantom-github-actions-ci-secret-stealer-stolen-tokens · ATT&CK page ↗

Execution TA0002

T1059.004Command and Scripting Interpreter: Unix Shell×1

Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux, macOS, and ESXi systems, though many variations of the Unix shell exist (e.g. sh, ash, bash, zsh, etc.) depending on the specific OS or distribution. Unix shells can control every aspect of a system, with certain commands requiring elevated privileges.

Evidence: 2026-11-13/wfx-phantom-github-actions-ci-secret-stealer-stolen-tokens · ATT&CK page ↗

Persistence TA0003

T1078.004Valid Accounts: Cloud Accounts×1

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-11-13/wfx-phantom-github-actions-ci-secret-stealer-stolen-tokens · ATT&CK page ↗

T1098.001Account Manipulation: Additional Cloud Credentials×1

Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.

Evidence: 2026-11-13/wfx-phantom-github-actions-ci-secret-stealer-stolen-tokens · ATT&CK page ↗

Privilege Escalation TA0004

T1078.004Valid Accounts: Cloud Accounts×1

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-11-13/wfx-phantom-github-actions-ci-secret-stealer-stolen-tokens · ATT&CK page ↗

T1098.001Account Manipulation: Additional Cloud Credentials×1

Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.

Evidence: 2026-11-13/wfx-phantom-github-actions-ci-secret-stealer-stolen-tokens · ATT&CK page ↗

Stealth TA0005

T1070Indicator Removal×1

Adversaries may selectively delete or modify artifacts generated to reduce indications of their presence and blend in with legitimate activity. Rather than broadly removing evidence, adversaries may target specific artifacts that appear anomalous or are likely to draw scrutiny, while leaving sufficient data intact to maintain the appearance of normal system behavior.

Evidence: 2026-11-13/wfx-phantom-github-actions-ci-secret-stealer-stolen-tokens · ATT&CK page ↗

T1078.004Valid Accounts: Cloud Accounts×1

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-11-13/wfx-phantom-github-actions-ci-secret-stealer-stolen-tokens · ATT&CK page ↗

Credential Access TA0006

T1552.001Unsecured Credentials: Credentials In Files×1

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.

Evidence: 2026-11-13/wfx-phantom-github-actions-ci-secret-stealer-stolen-tokens · ATT&CK page ↗

T1552.005Unsecured Credentials: Cloud Instance Metadata API×1

Adversaries may attempt to access the Cloud Instance Metadata API to collect credentials and other sensitive data.

Evidence: 2026-11-13/wfx-phantom-github-actions-ci-secret-stealer-stolen-tokens · ATT&CK page ↗

Lateral Movement TA0008

T1550.001Use Alternate Authentication Material: Application Access Token×1

Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems. These tokens are typically stolen from users or services and used in lieu of login credentials.

Evidence: 2026-11-13/wfx-phantom-github-actions-ci-secret-stealer-stolen-tokens · ATT&CK page ↗

Collection TA0009

T1213.003Data from Information Repositories: Code Repositories×1

Adversaries may leverage code repositories to collect valuable information. Code repositories are tools/services that store source code and automate software builds. They may be hosted internally or privately on third party sites such as Github, GitLab, SourceForge, and BitBucket. Users typically interact with code repositories through a web application or command-line utilities such as git.

Evidence: 2026-11-13/wfx-phantom-github-actions-ci-secret-stealer-stolen-tokens · ATT&CK page ↗

Entries about WFX Phantom (1)

2026-11-13 · view entry permalink →

NOTABLENATOB1

WFX Phantom: stolen GitHub tokens push a CI secret stealer into repositories from 2026-11-10, steal Actions secrets, runner memory and cloud tokens, plant AWS and Azure persistence designed to outlast rotation and delete the workflow runs; StepSecurity counts more than 63,000 probe pull requests

StepSecurity reports that from 2026-11-10 an attacker uses stolen GitHub tokens of real developer and bot accounts, as a developer would, not a bug in GitHub Actions, to push a CI secret stealer into repositories those tokens can write to (StepSecurity, 2026-11-12). It first opens a pull request titled "docs: dependency audit notes" from a branch named wfx-docs that only proves write access; StepSecurity counts more than 63,000 such probes by 2026-11-12 (StepSecurity, 2026-11-12), Aikido, which tracks the campaign as wfx-loot, counts 4,837 compromised accounts and at least 1,835 repositories where the payload ran, and Endor Labs counts 8,926 infected repositories (Aikido, 2026-11-12; Endor Labs, 2026-11-12); BleepingComputer reports that the compromised accounts included those of the US General Services Administration and the French government (BleepingComputer, 2026-11-12).

Where the token's permissions and the repository's setup let it run, the attacker pushes a script of about 1,500 lines through an edit to an existing workflow or CI shell script, a new workflow on a short-lived branch or a hidden script that an npm hook runs, and the script collects every Actions secret, the job token, the memory of the runner worker process and credential files for the major clouds and registries, then uses the job's OIDC token to open AWS, GCP and Azure sessions (StepSecurity, 2026-11-12). It plants persistence meant to outlast rotation, a rewritten AWS role trust policy with new access keys and federated identity credentials on Azure applications, sends the archive over HTTP and from 2026-11-12 through a Telegram bot, and within about a minute pushes a revert commit and deletes the workflow run, leaving a gap in the run numbers that StepSecurity calls the most reliable sign the stealer ran (StepSecurity, 2026-11-12). How the tokens were obtained is not known: some probes came through the Fly.io GitHub App, and StepSecurity has no evidence of a breach of Fly.io (StepSecurity, 2026-11-12). BleepingComputer's report of Aikido's findings gives the same probe title and start date (BleepingComputer, 2026-11-12).

Triage: a probe pull request alone shows that the account that opened it is compromised, even if nothing else happened; the payload probably ran where a commit with one of those messages is paired with a deleted run (StepSecurity, 2026-11-12).

The attacker does not exploit a bug in GitHub Actions.

The pull request does nothing by itself. It tells the attacker that the token can write to the repository. If you see one, the account that opened it is compromised, even if nothing else happened.

The gap is the most reliable sign that the stealer ran.

StepSecurity 2026-11-12

1,838 repos hit by v1/v2 got it again, so secrets rotated after the first wave are likely stolen again.

Endor Labs 2026-11-12

Builds on: GhostAction: fake security workflows now harvest whole git histories; rotating Actions secrets…

threat13 Nov 04:04Zmulti-sourceOpen finding →
Sources: StepSecurity · Aikido Security · Endor Labs · BleepingComputer

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Threats1

Source distribution

  • aikido.dev1 (25%)
  • bleepingcomputer.com1 (25%)
  • endorlabs.com1 (25%)
  • stepsecurity.io1 (25%)
All cited sources (4)